The authentication endpoint of WSO2 Identity Server returns different responses based on whether a supplied username exists in the system, enabling an attacker to discover valid user accounts. This weakness allows attackers to gather usernames for subsequent credential‑guessing, phishing, or information‑leakage campaigns. The vulnerability is classified as CWE-203, which involves error handling weaknesses that expose system state.

The affected components are WSO2 Email OTP Authenticator, WSO2 Carbon Abstract OTP Authenticator, and WSO2 Identity Server. No specific product version information is provided in the advisory; administrators should verify the current versions against the vulnerability list.

The CVSS score is 5.3, indicating moderate severity. EPSS information is not available, and the issue is not listed in the CISA KEV catalog. Inference suggests that the attack vector is remote, leveraging HTTP interactions with the authentication endpoint. An attacker simply needs to submit a username to the endpoint and observe the differing responses; no privileged access or additional discovery steps are listed.